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Secure Oblivious Watermarking using Key-Dependent Mapping Functions 
Technical Field 

This invention relates generally to data protection, and more particularly to aspects of 
a novel digital watermark system and methodology for multimedia content, such as audio, 
video, text, still images, computer graphics, and software. 

Cross-reference to Related Application 

The present application claims the benefit of provisional patent application Serial No. 
60/136,961 to Iu et al, filed on June 1, 1999, entitled "Secure Oblivious Watermarking using 
Key-Dependent Mapping Functions", which is hereby incorporated by reference. 

Background Art 

A watermark is an imperceptible or at least difficult to perceive signal embedded into 
multimedia content such as audio, video, text, still images, computer graphics, or software. 
The watermark conveys some useful information without disturbing or degrading the 
presentation of the content in a way that is noticeable or objectionable. Watermarking 
techniques play an important role in protecting copyright ownership of digital contents 
including images, audio, and video. Watermarks may be used to identify the original owner 
of the content, to trace where pirate copies of the content come from (fingerprinting), and to 
determine royalty payments by monitoring the number of times content has been used. 
Watermarks may also be used to authenticate original content and to locate change in a 
corrupted or altered copy of the content. In order to encourage copyright owners to use 
watermarking schemes, four basic and conflicting requirements should be met. Firstly, the 
distortion introduced by embedding the watermarks into content should be unperceivable by 



1999-30 



3 

regular users. Secondly, the watermarks should be secure so that they are hard to be modified 
or removed by the pirates. Thirdly, the watermarks should be robust against intentional 
attacks, ranging from simple content manipulation such as cropping, to common image 
processing techniques, such as filtering and compression. Lastly, the overall cost of using 
watermarking should not be expensive. 

Watermarking schemes may be categorized as non-oblivious or oblivious, depending 
on whether the original content is available or not. Oblivious watermarking may be defined 
as a watermarking scheme in which the original image is not available during watermarking 
decoding. Non-oblivious image watermarking schemes in general may be more robust due to 
the accessibility of the original image because image distortions caused by image processing, 
transmission, or intentional attacks may be compensated for using the original image. Also, 
the interference between the original image and the watermarks during watermark decoding 
may be removed by using the difference of the watermarked and original images. However, 
for many applications, such as copy and playback control, and copyright protection, the 
requirement of accessing the original image is simply not practical. This may make oblivious 
watermarking the only choice. 

Watermarks may be embedded in the pixel or the transform domains. Two papers 
which discuss and compare different methodologies and watermarking schemes include "A 
fair benchmark for image watermarking systems", by M. Kutter and F. A. P. Petitcolas, (SPIE 
Electronic Imaging' 99: Security and Watermarking of Multimedia Contents, vol. 3657, Jan. 
1999), and "Comparing robustness of watermarking techniques" by J. Fridrich and M. Goljan 
(SPIE Electronic Imaging' 99: Security and Watermarking of Multimedia Contents, vol 3657, 
Jan. 1999). Proposed transforms include DCT, DFT, LOT, wavelets, Hadamard transform 
and key-dependent transforms. The watermark signal in a transform domain may usually be 
related to that in the pixel domain by a linear transformation, if the transform itself is linear. 
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However, the analysis may be applied to pixel-based approaches as well. Human visual 
models have been used to adjust watermark strength so that embedded watermarks maybe 
invisible. Spread-spectrum techniques are widely used by most oblivious watermarking 
approaches. When extracting the watermark message, these methods may rely on the 
watermark information embedded in the middle frequencies, although the noise-like 
watermark signal may also be embedded in the low and the high frequencies. The watermark 
information in the high frequencies may be easily removed using low-pass filtering and JPEG 
compression, and humans may be able to tolerate high distortion there. For low frequencies, 
watermark signals may have a high interference with the image itself. Note that the energy of 
a typical image may be concentrated in the lower frequencies. 

For non-oblivious watermarking, adding watermarks in the low frequencies has been 
shown to have some advantages in a paper entitled "A review of watermarking and the 
importance of perceptual modeling", by I. Cox and M. Miller, Proc. of the SPIE Human 
Vision and Electronic Imaging, vol. 3016, pp. 92-99, Feb. 1997. More watermark messages 
may be sent while the noise level of the image does not increase. Watermarks in the low 
frequencies in general may be more robust than that in the middle frequencies, with respect to 
image distortions that have low-pass characteristics, such as filtering. Examples of nonlinear 
filtering, may include median filting, lossy compression filtering , and adaptive Wiener 
filtering. Watermarks in the low frequencies may also be less sensitive to small geometric 
distortions (e.g., rotation, shifting, and scaling). Therefore, seeking oblivious watermark 
schemes unitizing the low frequencies and distortion compensation techniques without the 
original image have become two active research topics. 

Several watermark attack and counterattack methods have been proposed. To 
overcome a geometric attack, small blocks of a corrupted image may be registered with an 
original pseudo noise signal using correlation matching. Watermarks may also be removed 
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by capturing watermark information pixel by pixel with a sensitivity attack if a pirate has 
access to a device that can detect whether the content contains a watermark or not. 

To handle distortions without the original image, a calibration pattern may be 
embedded into the Fourier transform in the log-polar coordinates, so that the shift, scaling, 
5 and rotation of the image may be compensated. 

Some oblivious watermarking approaches using the low frequency bands have been 
proposed including embedding watermark information by swapping selected transform 
coefficients of 8x8 DCT blocks. The robustness of this type of approach may not be high and 
visible distortions may be introduced. 
!0 Another approach includes embedding watermark message bits into disjoint triplets of 

wavelet coefficients, which may be chosen according to a key-dependent random sequence. 
The middle coefficient may be quantized by a quantization step, what is equal to the 
difference of the largest and the smallest values of the triplet, divided by a fixed scale factor. 
This approach may not be applied to DCT coefficients since the standard deviation of the 
15 DCT coefficients in low frequencies may typically be very high. This requires a large fixed 
scale factor, or equivalently a small quantization step, in order for the watermark to remain 
invisible. Therefore, the robustness has to be compromised. Similar quantization techniques 
have been proposed to embed a cartoon or map image into a host image. 

Quantization with frequency and spatial masking to embed watermarks into DCT 
20 coefficients of 8x8 blocks has also been proposed. Watermarks using a small block size may 
not survive the distortions introduced by filtering with a large kernel. The suggested 
frequency masking model also becomes inaccurate for blocks larger than 16x16. 

Yet another proposed method includes using the quantization index modulation to 
embed a watermark message into a host image. Message bits are used to select the pre- 
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defined quantizers. Theoretical results for some channel models have been discussed. 
However, no experiments on real distortions have been reported. 

Watermarks inserted in the middle and high frequencies may typically be very robust 
with respect to noise adding, nonlinear deformations of the gray scale, (e.g., 
5 contrast/brightness adjustment, gamma correction, histogram equalization), and cropping. 
Since these advantages are complementary to that of low-frequency techniques, and 
watermarks of low and middle frequencies are embedded into disjoint portions of the 
spectrum, Fridrich proposed to embed both low and high frequency watermarks into the 
image. To decode the hidden message in the low frequencies without the original image, 

10 binary mapping may be used. A (watermark) mapping function (also called an index 

function) may relate the watermarked transform coefficient to the watermark itself. Although 
it has been shown that the watermarks may be very robust to different types of distortion, 
there may be a serious security problem. The watermarks may be easily removed by 
clustering the DCT coefficients using a histogram attack, which may search for the 

15 parameters of the mapping function. If the intensity of some of the original pixels are guessed 
and if the basis function is known, then the watermarks may be estimated and the general 
watermark system fails. To overcome the histogram and the watermark-estimation attacks, it 
has been proposed that some secret key-dependent basis functions could be used. Although 
this scheme seems to be able to achieve better robustness to different distortions and high 

20 security to attacks, it may require very high computation and a relatively large amount of 
storage to generate the basis functions and to find the corresponding transform coefficients. 

We will now discuss briefly an oblivious watermark approach, described in a paper by 
J. Fridrich, entitled "Combining low-frequency and spread spectrum watermarking", Proc. 
SPIE Int. Symp. on Optical Science, Engineering Instrumentation, San Diego, July 1998, 
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which uses a binary mapping function. A security problem will be disclosed using a 
histogram attack. 

The oblivious low frequency watermarking of Fridrich is described as follows. Let 
f 0 (Pj) be the intensity of an image at a j-th pixel pj = [xj, yJ T J e j, where J = {j \j = 0,1, ... 
5 ,n p - 1} consisting of the index of all n p pixels in a raster scan order. Figure 9A shows some 
raster scan orders that may be used. The present invention may be practiced with any scan 
order, several of which are shown in figures 9A, 9B, 9C, and 9D. Let m(f 0 ) and a 2 (f 0 ) be the 
sample mean and variance of f 0 . The image may be normalized by the following transform so 
that its sample mean becomes zero and its coefficients of discrete cosine transform (DCT) 
10 may fall into a pre-specified range. 

~ . _1024f o ( Pi )-m(f o ) 

f(Pj) W 



Denoting the original and watermarked DCT coefficients of / as vj and Vi T , let i e I where / = 
{ / 1 i = 0,1, . , n w - 1} consists of the index of DCT coefficients in a zig-zag order. Then a 
binary watermark sequence w h e /, w f e {- 1 , 1 } may be embedded to / by adjusting the 
15 amplitude of v/, so that the distortion between v f and v/ is minimum and 

Wi =M 0 (\vi'\). (2) 



where the mapping function 

M 0 (y*) =(-!)' if v'eI n =[a l ,a M l a = y^>h a>0 (3) 



If Vi < 1, Vi = v L The above mapping function is called an index function. It can be shown 
20 that the maximum difference between v t and v,-' is less than |v,|a. In order to maximize the 
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robustness with respect to image distortions, v,-' is chosen to be the middle point of interval In. 
To survive some common lossy compression and low-pass filtering, the watermarks may be 
embedded in the perceptually significant frequency bands with high energy, and the amount 
of change of different transform coefficients may be proportional to the amplitude of the 
coefficient itself. The watermark encoding and decoding may be simplified if they are 
performed in a log-magnitude domain. Let u t = ln|v,-|, u( = ln|v/| and (3= In a. The l-th interval 
in the log domain may be denoted by hi = [/p, (/+1)P). The index of the interval where u is 

located may be determined by a locating function l(u) = Lj^l The watermark may be 

generated by the following mapping function 

=Mi(wj ! ) 

= (-iyi«> (4) 

and assign ui=q(u?) 9 where q(m) = (l(ui) + 0.5)p is the quantization function. More 
specifically, if (-1) (M,) = w i9 then u- = q(ui). Otherwise, u- maybe equal to either q(ui) + p or 
q(ui) - p, depending on which is closer to u t . 

During watermark decoding, the watermark may be estimated from the received DCT 
coefficient Uj" as w i = M 1 (u"), where 

m/" =u} + m (5) 

and rii is the noise. Then the watermark sequence may be determined by using the following 
correlation function 
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where the scale factor s may be used to compensate the change of variance due to image 
distortions, and the weighting factor y may be used to reduce the effect of small coefficients. 
The values A s = 1/4 and y = 1 will be used in the disclosure of the present invention. 

Combining with mid-frequency watermarking using the spread spectrum technique, 
5 the above binary watermarking has been shown by Fredrich to be robust for many attacks. 
However there arises a serious security problem. Since the watermarked coefficients u( are 
always located in the middle of the quantization intervals with a fixed size, a pirate may 
search for the correct quantization step using a histogram attack. Once the quantization step 
is found, the watermarks may be modified or removed. The histogram may be formed from 

10 the quantized DCT coefficients with a guessed quantization step size. For the correct step 
size, a peak will be present in the middle of the quantization interval 

Fridrich has observed this problem. He also discussed the security problem faced 
under the watermark-estimation attack. If the original intensity of some pixels of a 
watermarked image can be guessed, then the watermarks may be estimated and removed by 

15 solving a system of linear equations. To address both security problems, Fredrich proposed 
the use of key-dependent basis functions. He also demonstrated that his approach was quite 
robust to common distortions. However, his approach requires a high computation to 
generate the transform functions and to perform the forward or inverse transforms. To 
provide an alternative, the present invention will disclose a new class of mapping functions, 

20 which may require only simple operations. These mapping functions may be controlled by a 
secret key. To combat the watermark-estimation attacks, some counter-attacks will also be 
disclosed. 

What is needed is a simple and effective scheme to enhance the security and 
robustness of a low-frequency watermarking scheme that protects the watermarks by using a 
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secret (watermark) mapping function instead of a secret transform basis function. The 
scheme should also reduce the interference between the watermarks and the image itself by 
using a key-dependent quantization function. The scheme should also be generalized so that 
it may be applied to pixel-domain watermarking schemes. To combat the watermark- 
5 estimation attack, a simple counterattack is also needed that that the use of key-dependent 
basis functions isn't needed. 



Disclosure Of The Invention 

One advantage of the invention is that it that protects watermarks by using a secret 

10 (watermark) mapping function instead of a secret transform basis function. 

Another advantage of this invention is that it reduces the interference between the 
watermarks and the image itself by using a key-dependent quantization function. 

Yet a further advantage of this invention is that it is generalized so that it may be 
applied to pixel-domain watermarking schemes. 

!5 To achieve the foregoing and other advantages, in accordance with all of the invention 

as embodied and broadly described herein, a method for embedding a watermark into content. 
The content contains content samples. The method including the steps of: receiving the 
content, creating a continuous watermark sequence from the watermark, for each content 
sample in a first predetermined order: calculating a sample mean, calculating a sample 

20 variance, and normalizing the content. Further steps include generating a set of content 

coefficients from the content, generating a set of watermark coefficients from the watermark 
sequence, embedding the watermark in the content by adjusting the amplitude of the 
watermark coefficients so that the distortion between the content coefficients and the 
associated watermark coefficients are minimized using a secret mapping function, and 

25 outputting the content. 
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In yet a further aspect of the invention, a method for a method for embedding a 
watermark into content, wherein the step of embedding the watermark in the content is 
performed by adjusting the watermark coefficients sequentially in a second predetermined 
order. 

5 In yet a further aspect of the invention, an apparatus for embedding a watermark data 

into content including: a content preprocessor, the content preprocessor further including: 
a mean calculator; and a variance calculator; a content coefficient generator for generating 
content coefficients from the preprocessed content; a watermark sequence generator for 
generating a watermark sequence from the watermark data; a watermark coefficient generator 

10 for generating watermark coefficients from the watermark sequence; and a watermark inserter 
for generating watermarked content. The watermark inserter may further include a key 
dependent sequencer; a secret mapping function device, the secret mapping function device 
receiving input from the key dependent sequencer; and a coefficient modifier for generating 
watermarked content by adjusting the amplitude of the watermark coefficients so that the 

15 distortion between the content coefficients and the associated watermark coefficients are 
minimized using the secret mapping function device. 

Additional objects, advantages and novel features of the invention will be set forth in 
part in the description which follows, and in part will become apparent to those skilled in the 
art upon examination of the following or may be learned by practice of the invention. The 

20 objects and advantages of the invention may be realized and attained by means of the 
instrumentalities and combinations particularly pointed out in the appended claims. 



25 



Brief Description Of The Drawings 

The accompanying drawings, which are incorporated in and form a part of the 
specification, illustrate an embodiment of the present invention and, together with the 
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description, serve to explain the principles of the invention. 

Figure 1 is a block diagram of a watermark insertion device as per an embodiment of 
the present invention. 

Figure 2 is a block diagram of a watermark inserter as per an embodiment of the 
5 present invention. 

Figure 3 is a block diagram of a watermark extractor as per an embodiment of the 
present invention. 

Figure 4 is a flow diagram showing how a watermark may be inserted into content as 
per an embodiment of the present invention. 
10 Figure 5 is a flow diagram showing how a content may be preprocessed as per an 

embodiment of the present invention. 

Figure 6 is a flow diagram showing watermark content being embedded into content 
data as per an embodiment of the present invention. 

Figure 7 is a flow diagram showing how a watermark may be extracted from 
15 watermarked content as per an embodiment of the present invention. 

Figure 8A is a diagram illustrating a square mapping function that may be used in 
practicing the present invention. 

Figure 8B is a diagram illustrating a saw tooth mapping function that may be used in 
practicing the present invention. 

20 Figure 8A is a diagram illustrating a trianglar mapping function that may be used in 

practicing the present invention. 

Figure 9A is a diagram illustrating horizontal processing orders that maybe used when 
practicing the present invention. 
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Figure 9B is a diagram illustrating vertical processing orders that may be used when 
practicing the present invention. 

Figure 9C is a diagram illustrating horizontal zig-zag processing orders that may be 
used when practicing the present invention. 
5 Figure 9D is a diagram illustrating vertical zig-zag processing orders that may be used 

when practicing the present invention. 

Best Mode For Practicing The Invention 

The present invention is a new method for watermarking content using a novel class of 
10 secure mapping watermarking functions using key-dependent mapping functions. 

The binary watermarking scheme disclosed by Fredrich and discussed in the 
background section may be defeated by a histogram attack because the DCT coefficients may 
be clustered in the middle of the interval for the correct quantization step size p. The present 
invention overcomes this security problem by first replacing the binary watermark sequence 
15 by a continuous sequence and by using secret mapping functions for different DCT 

coefficients. Replacing the binary watermark sequence by a continuos sequence may cause 
the DCT coefficients after quantization to spread out in the quantization interval, making the 
search for the original quantization step size p difficult. Using secret mapping functions for 
different DCT coefficients may make the histogram attack impossible because the mapping 
20 functions may not be known and may be changed for different DCT coefficients. 

In general, many functions may be used as the mapping functions. The functions may 
be generated by a program or retrieved from a look-up table. For the robustness concern to 
different distortions or attacks, it may be required that these functions are continuous or at 
least piecewise continuous. Otherwise, a small change of the DCT coefficients may introduce 
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a big error in the estimated watermark. To make these mapping functions practically useful, it 
may be important that these functions may be rapidly computed or generated in real-time 
and/or they do not require a large space to store their values. The present invention may use 
mapping functions which preferably take a simple function form. Their parameters may be 
5 controlled by some key-dependent random sequences to offer security. 

Assume that the watermark sequence Wi is an uniformly distributed random sequence 
with zero mean and unit variance, i.e. w t e [-a/3, ^3]. One approach to embed this watermark 
sequence to the image is to generate the watermarked signal u/ so that 

"/ =q(ul) + aiW U (7) 

10 and the closest u- with respect to u t is selected. It means that if u t = q{ui) + a t w u then u- may 
be equal to u h u t + p,- or u t - p„ depending on which is closest to u lt For different DCT 
coefficients, the quantization step size may be controlled by a key-dependent sequence p;. 
The sequence p/ may be uniformly distributed in Sp = [p oz * - A p? p o/ + A p ], The watermark 

strength may be controlled by a h which is preferably set to be a,- = in order to map a 

15 quantization interval to a full dynamic range of the watermark sequence. From (7), the new 
mapping function may be found as 

= M 2 (u\) (8) 

The above mapping function may be a sawtoothed function as shown in Figure 8B. From (7), 
it may be shown that, the i-th DCT coefficient after watermarking may be related to the v f and 
20 Wi by 
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Vi = Vi exp(oc/w z ) exp(Av) 



(9) 



where Av = q(ln\v\\) - /«|v,-|. The error Av may come from the quantization process. 

From (5) and (7), it may be shown that w, = M 2 (m,") + ri u where n\^-[q( Ui ") - q(u' £ ) - 

OC/ 

n t ]. If the noise m is of low energy, u" may fall into the same quantization interval as u t \ i.e. 
5 0(n f ") = It implies that w t = M 2 (u")- h/<x,-. Therefore, a good estimate of w t from h/' 
maybe 

Hto =M 2 (u i n ). (10) 



The watermark sequence may be determined by using the correlation in (6). Note that only 
ut may be required to find this watermark estimate. It means that the original image may not 
10 be required to extract the watermark sequence. Since the mapping function M 2 (u) may be 
easy to compute, the computation requirement for watermark encoding and decoding may be 
relatively low. 

Since the mapping function M 2 (u) is preferably controlled by the secret random 
sequence (3; and each DCT coefficient may have a different quantization step size, it may be 

15 very difficult for a pirate to estimate the mapping functions for all DCT coefficients or the 
watermark sequence. Note that both values of the watermark sequence and the may be 
continuous, which mat make estimation even harder. The histogram of the quantized DCT 
coefficients for different p may be quite random, demonstrating that the watermarks as well as 
the mapping functions may be protected under this attack. 

20 One more layer of security may be offered via the design of the mapping function by 

allowing a varying size of the quantization intervals for quantizing the DCT coefficients, 
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resulting in the interval length preferably varying for different i, i.e. I 31 = [Z^PiG), Z^P/CD 

for the l-th interval. This may require more computation for watermark encoding, watermark 
decoding and generating more random sequences for p z {/). 

For the saw-toothed mapping function, there may be a problem for the robustness of 
5 the watermark recovery. If the noise n x makes the received up fall out of the original 
quantization interval, a large error may be introduced. It may specially be the case at the 
borders of the quantization intervals, where an abrupt sign change may occur to the 
watermark estimate. To overcome this problem, a triangle mapping function is proposed. 
The basic idea is to eliminate the sharp changes in the saw-toothed function that causes the 
10 sign change of the adding watermark. The mapping function in equationlO therefore becomes 

= M 3 (u/) (11) 

To insert watermark, adjust u/ so that 

u * =q(ui) + (Af u ' ) a i w ! (12) 

This may be achieved by simply assigning q(ui) + (A) m a{Wi to uP There is no need 
15 to find the closest u{ due to the characteristics of the mapping function. Figure 8C shows the 
triangle mapping function M 3 (u). To improve further the overall stealth, the above watermark 
encoding and decoding may be modified as follows so that the final sign of the embedded 
watermark may be controlled by an additional key-dependent random sequence st e {0,1}. 

Wi =( _ 1) K^-L [tt/ _ ?(M/0] 



1999-30 



17 

= M 4 (u/). (13) 

u i =q{u;) + {-\f u:) ^a i w I (14) 
Similar to the saw-toothed function, if the noise n t is not large, i.e. q(u") = q{ul\ then w t = 
M 4 (u")- w/a,-. A good estimate of w f from u" without knowing the u t or ui becomes w £i = M 4 
(«,")■ 

For the binary mapping function, its security problem may be overcome by using 
5 randomized quantization steps, i.e. 

Wi = q{ul) with key-dependent quantization step size p;. 

= MiW) (15) 



The watermark estimate of that becomes w bi = Mi'(w/'). 

This scheme protects the watermarking system under histogram attack. Since each 
DCT coefficient has its own quantization step size, the attack which searches for a common 
10 step size would fail and the histogram will appear to be random. Histograms for the binary 
and saw-toothed mapping functions with a random sequence of p/may show no distinctive 
peak that can be identified and the resulting data display may show a randomized behavior. 

For generalized mapping functions, periodic functions with key-dependent parameters 
may be used as follows 

w(ui) = f(A L f u QiUi) (16) 
15 Where A t may be the amplitude,/] may be the period, 0/may be the phase. This leads to 

w Md = ~W -q{ui 

Hence 
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Ui = q(u,) + ,a,w/(«/) + 9/)] 



Which leads to 

W 2 (u) = At cos (27rf,{u,) + 9,) 

Rewatermarking may be accomplished with and without quantization, where the 
5 received watermark coefficients may be described by 

u i =w/ + (-l) v " aiWt 

A truncated function may be used 

lp 0 < x < Ifi 

Ti(fo) = x 10<x(l+l) 

(l+i)P x> (i+\)p 



^ =t\(u i + (-lf u, ' )+s -a i w i 



10 For the binary, saw-toothed, and triangle mapping functions in equations 4, 10, and 

13, respectively, their distortions during watermark encoding and the watermark estimate 
error during watermark decoding are analyzed. Note that since these mapping functions are 
periodic, analyzing one period of each function is sufficient without loss of generality. Let 
Au bi = Ui - u'u, Au s f= Ui - u\i, Autf= Ui - u' H , Aw b j= w t - w bi , Aw st = w { - w si , and Aw tl = w ( - w tl . 

15 Denote regions according to the location index /(«/) as R a = Kj k [(/(«/) + 2k)% (/(«,") + 2k + 
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1)P,], R bl = Kj k [(%')+ 2k + 1)0,, 2k + 1.5)0,], i? w = u* [(/(«/)+ 2* + 1.5)P,, (/(«/)+ 2£ 

+ 2)PJ, and R b = R bl u i? &2 - Note that the period of the mapping function is 2p,. Let 

n t =2k$i + nn, A=0,±l,±2, ... (16) 

where n n e(-0.5p, - am, 1.5p, - am)- 
5 For the binary mapping function, if the log-magnitude of the i-th DCT coefficient after 

watermarking, u{, may fall into the same interval as that of u„ i.e. q(u?) = qfe), the watermark 
encoding error simply equals to the quantization error. It means that \Au bi \ = \u t - q(ui)\ e [0, 
p,/2) because «/ = q(u{). If ul falls into the interval before or after the interval of u u i.e. q(u>) 
= q(ui) ± 1, then |Aw w | e [p/2, p,) (c.f.\ Figure 8 A). Similarly, for the saw-toothed mapping 

10 function, if q(u}) = q(u,), then the watermark encoding error equals to the quantization error 
and |Ak s/ | e [0, p/2). Otherwise, \Au si \ e (0, p/2]. For the triangle mapping function, as 
mentioned before, q(u!) always equals to q(ui). Therefore, the watermark encoding error 
|Au /; }| e [0, p,). Table 1 summarizes these results. As we can see, for the same P,, the 
triangle mapping function may have a larger encoding error than that of the saw-toothed 

15 mapping function. 

For the binary mapping function, if the received DCT coefficient k," falls into R a , the 
watermark w, can be decoded correctly, i.e. Aw bi = 0. Otherwise, the sign of w, maybe 
reversed which may lead to a decoding error of 2. 

For the sawtoothed mapping function, from equation 10, we have 

A\V si - Wj - W si 

= Z-(q(un-q(u/)-nd 
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= ^f^^rn ]d (17 ) 



If u/' e R a , then L^-^Jp,- = L^Jp,-. Therefore, Aw sl = = since a,- = 0/(2^3). If 

e and n H > 0, then L^Hr^Jp, = Lj-pjp, + p,. This may imply that Aw J( - = = 2^3 

Pi Pi OC, 

(1- ^). Finally, if w," e i? 6 and n n < 0, we have l _" f * " ;< J p 7 = L^Jp/ - p,-. In other words, Aw,/ 
-Pi - n n rr J«/jL 

For the triangle mapping function, if u t " e i? a , i.e. (-l)^" 0 = (-lf" n , we have 
Aw ft - = Wi - M 3 (w ( ") 

= (-D /W (-Tf) 



= (-1/^-2^) (18) 



On the other hand, if e i.e. = (-l) /( " r)+1 , then 

Aw ri =(-lf un ^iu i ' + u i "-q(u/)-q(u i ")] (19) 



Since aw,- + n n = p, + (« " - q(u ,")), Aw ri } can be rewritten as 
Aw* =(-l/ (l "' ) [2w, + (n«-p ! )/a i ] 

= (-l) /( " r) [2w,- + 2>/3(» ;i /p, - 1)] (20) 
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Table 2 summarizes these results. 

Comparing the saw-toothed and the triangle mapping functions, when u" e R a , they 

may have the same watermark decoding error, i.e. \Aw si \ = |Aw ft -| = 2a/3^. If u" e R b and Wi 

Pi 

> 0, \Aw si \ - \Aw ti \ = 2[^ " - wi\. This leads to two different cases. If u" eR bI ,a {Wi < p,- - 

5 ////, then we have |Atv„-| > \Aw ti \. Similarly, if «/' e a,-w/ > p* - w;,-, we find |Aw„-| < |Aw tf |. 
Similar results for other cases can be derived. The results are summarized in Table 3. 





\Au bi \ 


\Au si \ 


\Au ti \ 


q(u,) 


[0, (3/2) 
[(3/2, p f ) 


(0, P/2] 


Not apply 



Table 1 . Watermark encoding errors for binary, saw-toothed and triangle mapping functions. 





\Aw bi \ 


\Aw si \ 


\Aw ti \ 


Ra 
Rb 


0 
2 


2^^ 
V Pi 

2^11-^1 

Pi 


2a/3 M 

P>/3^-2HI 



10 Table 2 - Watermark decoding errors for binary, saw-toothed and triangle mapping functions. 



Ui" 


Wi>0 


Wi<0 


Ra 


\Aw tl \ = |Aw„| 


\Aw ti \ = \Aw si \ 


Rbl 


\Aw ti \ < |Aw SI -| 


\Aw ti \ > \Aw si \ 


Rb2 


\Aw ti \ > \Aw si \ 


\Aw tl \ < \Aw si \ 
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Table 3 - Comparisons of watermark decoding errors between saw-toothed and triangle 
mapping functions. 

One type of attack to a watermark system is to estimate the unknown watermarks from 
a given watermarked image f 0 \ by assuming that part of the original image f Q may be guessed 
5 or closely approximated. This is called the watermark-estimation attack. For example, the 
intensity of a uniform region in the original image may be reasonably approximated by the 
sample mean of that region. Assume that the watermark sequence is embedded in some 
transform coefficients. For convenience, the original intensity of pixel p y may be represented 
by MVj) = Z iVi&i(Pp CO/), where v,- is the i-th transform coefficients of the corresponding 
10 basis function 0 t (p j9 ©,-), and CO,- = [® xi , (£> yi f denotes the frequency component of this 2-D 
transform. Note that a sequential order may always be imposed to the index of the frequency 
components of a 2-D transform, such as a zigzag order of DCT coefficients. Figures 9 A, 9B, 
9C, and 9D show examples of various orders that may be used. 

Let Vi be the corresponding watermarked coefficients. The difference between the 
1 5 original and watermarked images at pixel p y may therefore be 

fo(Pj)-fo(pj) = | ; ^^<P>^) (21) 

where v di = v,- - v/. Under the watermark-estimation attack, if a pirate guesses the original 
intensity of a sufficient number of pixels, the value of v di may be determined by solving the 
above linear system. If the watermarking scheme is not properly designed, the watermark 
20 sequence w t may be easily estimated. For example, one approach may be to embed the 

watermark sequence w t as v/ = v,{l + aw f ), \ Given v/ and v dh the watermark sequence may 
v/ 

be found by aw t = , . Key-dependent basis functions may be used to protect the 
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watermarks. Since the basis functions may be kept secret, a pirate may not find the transform 
coefficients, neither vf nor v di . For key-dependent mapping functions as per the present 
invention, since the mapping functions are preferably unknown, the watermarks may not be 
determined even if the pirate knows the transform function. As a result, both Fridrich's and 
our approach may keep the watermarks secure, while our approach requires much lower 
computations. 

Another counterattack to offend the watermark-estimation attack may be to add some 
noise to the image to corrupt quality of the estimation of v di . The added noise may make the 
estimation of watermarks for this attack unusable. However, if the intention of the pirate is to 
remove the watermarks instead of extracting it, the above watermark-estimation attack may 
causes a serious problem. If v/ and v di are available, then V/ may be directly computed from v, 
= Vi'+v^-. As a result, the watermark information may be removed completely by replacing v ( - ' 
of the watermark image by V;. This problem may not be overcome by either our proposed 
mapping functions, nor adding noise to the watermark image. The approach of using the key- 
dependent basis functions may also fail. A pirate may select some well-known basis 
functions and estimate v,- with respect to these basis functions. Such a replaced v f - may still be 
used to remove the watermarks that are embedded in the transform coefficients with respect to 
the unknown key-dependent basis functions. The reason for that is the representation of the 
original image with respect to the basis functions may be unique, and the transform 
coefficients using two different basis functions may be related by a linear or non-linear 
transformation. 

Fortunately, there is a simple solution for solving this problem. For the pixels whose 
intensity may be estimated easily, after watermarking, the pixels in the watermarked image 
may be replaced by the pixels in the original image. In this case, v di may not be estimated 
because the left hand side of (23) may be equal to zero. The new transform coefficients of the 
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new watermarked image with this replacement should be quite close to the original v{ because 
only a small portion of pixel intensities are affected. This treatment should not degrade the 
picture quality since it only brings the final image to be closer to the original, and most likely 
such substitution takes place at uniform regions. The detection of the watermark should also 
5 remain robust since the majority of the pixels are not altered and may be used for watermark 
decoding. 

Furthermore, some experiments have been performed for the watermark-estimation 
attack. It was found that the estimate of v d t had a large error even when there was only 
rounding noise in the watermark image. A routine of singular value decomposition was 

10 adopted to avoid the numerical problem caused by a singular matrix in solving equation (23). 
Therefore, the watermark-estimation attack seems to be less damaging. 

We will now start to describe some embodiments of the present invention by referring 
to figures 1 and 2. Figure 1 is a block diagram of a watermark insertion device as per an 
embodiment of the present invention. Figure 2 is a block diagram of a watermark inserter 150 

15 as per an embodiment of the present invention. Content 100 may be input to a content 

preprocessor 110. The content may be still any type of information including images, video, 
and music. The content preprocessor 110 preferably normalizes the image and may include a 
mean calculator 112 and variance calculator 114 for calculating the mean and variance values 
of the content 100. After being preprocessed by the content preprocessor 110, a content 

20 coefficient generator 120 may generate content coefficients. These coefficients may be 
coefficients for any type of function that may be used to describe the content, such as DCT 
coefficients. A watermark 102 may be converted into a watermark sequence by a watermark 
sequence generator 130. The watermark sequence may then be input to a watermark 
coefficient generator 140 which may generate coefficients that may be compatible with the 

25 content coefficients. A watermark inserter 150 accepts as input both the content coefficients 
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202 and the watermark coefficients 204 , and modifies them using a coefficient modifier 212. 
A key dependent sequencer 216 outputs a sequence to a secret mapping function device 214. 
The output of the secret mapping function device 214 may be used by the coefficient modifier 
212 in generating watermarked content 160 by adjusting the amplitude of the watermark 
5 coefficients 204 so that the distortion between the content coefficients 202 and the watermark 
coefficients 204 may be minimized. 

Figure 3 is a block diagram of a watermark extractor as per an embodiment of the 
present invention. The watermark extractor 300 preferably accepts as input watermarked 
content 302 and outputs a watermark sequence 304. Watermark estimator 310 estimates a 
10 watermark from the watermarked content 302, a mapping function 314, and noise 316. The 
mapping function 314 uses input from a key dependent sequencer 312 in generating its 
sequence. A correlator may accept as input the watermarked content 302, a scale factor 322 
and a weight factor 324 and uses a correlation function to generate the watermark sequence 
304. 

15 Figure 4 is a flow diagram showing how a watermark may be inserted into content as 

per an embodiment of the present invention. First the content may be received for processing 
at step S404. A continuous watermark sequence may be generated at step S404. Step S406 
preprocesses the content. The preprocessing may normalize the content and may include 
mean and variance calculations. At step S408, the watermark is inserted into the content. 

20 Finally, at step S410 the watermarked content is output. 

Figure 5 is a flow diagram showing how a content may be preprocessed as per an 
embodiment of the present invention. This diagram is an expansion of step S406. A content 
sample pointer is initialized at step S502. A sample mean and variance may be calculated at 
step S504. The content may then be normalized around the content sample at step S506, after 

25 which the sample pointer may be incremented per a first predefined order. The order may be 
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any number of orders such as those shown in figures 9 A, 9B, 9C, and 9D. Next, a 
determination is made at step S510 if the process is complete. If the determination is positive, 
the process stops, otherwise the processing continues at step S504. 

Figure 6 is a flow diagram showing watermark content being embedded into content 
5 data as per an embodiment of the present invention. This diagram is an expansion of block 
S408. Content coefficients may be generated at step S602 and watermark coefficients may be 
generated at step S604. A coefficient pointer may be initialized at step S606. At step S608, 
the amplitude of a watermark coefficient being pointed to by the coefficient pointer may be 
adjusted so that the distortion between the watermark coefficient and its associated content 

10 coefficient are minimized using a secret mapping function. . Next, a determination may be 
made at step S610 if the process is complete. If the determination is positive, the process 
stops, otherwise the processing continues at step S608. 

Figure 7 is a flow diagram showing how a watermark may be extracted from 
watermarked content as per an embodiment of the present invention. Watermarked content 

15 coefficients may be received at step S702. An estimated watermark using the received 
coefficients, a mapping function, and noise may be generated at step S704. Next, a 
correlation function may be used to determine the watermark sequence at step S706. The 
correlation function may use a scale factor a weighting factor, the watermarked content, and 
the watermark estimation in determining the watermark sequence. The watermark sequence 

20 may be output at step S708. 

A simple but effective way to protect the watermarks for oblivious watermarking by 
using a new class of mapping functions has been disclosed. These functions may be 
controlled by key-dependent random sequences. The watermark encoding and decoding may 
only require a simple computation. A security problem of a binary mapping function may be 

25 overcome by using random quantization steps. The disclosed mapping functions may be 
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applied to pixel-based approaches and other transform-based approaches including the key- 
dependent basis functions. The discussion on watermark-estimation attack indicates that this 
attack may be defeated easily. Thus, the use of key-dependent mapping functions may 
provide an alternative to build a secure and robust oblivious system instead of using the time- 
5 consuming key-dependent basis functions. 

The foregoing descriptions of the preferred embodiments of the present invention have 
been presented for purposes of illustration and description. They are not intended to be 
exhaustive or to limit the invention to the precise forms disclosed, and obviously many 
modifications and variations are possible in light of the above teaching. The illustrated 

10 embodiments were chosen and described in order to best explain the principles of the 
invention and its practical application to thereby enable others skilled in the art to best utilize 
the invention in various embodiments and with various modifications as are suited to the 
particular use contemplated. For example, one skilled in the art will recognize that the present 
invention may be used with other types of content besides just images such as music, video, 

15 and data. It is intended that the scope of the invention be defined by the claims appended 
hereto. 
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CLAIMS 

We claim: 



1 1 . A method for embedding a watermark into content, said content containing content 



2 


samples, comprising the steps of: 


3 


(a) 


receiving said content; 


4 


(b) 


creating a continuous watermark sequence from said watermark; 


5 


(c) 


for each content sample in a first predetermined order: 


6 




(i) calculating a samnle mean* 


7 




Tiri calculating a samnle variance* and 

\ *y UlUllllg u. OC4-i.XJ.Lf J.W V CL1 1 KXy JLV^ w ^ Clllvl- 


8 




(iii) normalizing said content; 


9 


(d) 


generating a set of content coefficients from said content; 


10 


(e) 


generating a set of watermark coefficients from said watermark sequence; 


11 


(f) 


embedding said watermark in said content by adjusting the amplitude of said 


12 




watermark coefficients so that the distortion between the content coefficients 


13 




and the associated watermark coefficients are minimized using a secret 


14 




mapping function; and 


15 


(g) 


outputting said content. 



1 2. The method according to claim 1 wherein said step of embedding said watermark in 

2 said content is performed by adjusting the watermark coefficients sequentially in a 

3 second predetermined order. 

1 3. The method according to claim 1 wherein said digital content is an image and said 

2 content sample is a pixel. 
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The method according to claim 1 wherein said secret mapping function has 
parameters, and said parameters are controlled by one or more key-dependent 
sequences. 

The method according to claim 4 wherein said key-dependent sequences are key- 
dependent random sequences. 

The method according to claim 4 wherein at least one of said key-dependent 
sequences are uniformly distributed. 

The method according to claim 4 wherein at least one of said key-dependent 
sequences is continuous. 

The method according to claim 4 wherein at least one of said key-dependent 
sequences is secret. 

The method according to claim 1 wherein each watermark coefficient may have a 
different quantization step size. 

The method according to claim 1 wherein said secret mapping function is a 
sawtoothed function. 

The method according to claim 1 wherein said secret mapping function is a triangle 
mapping function. 
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The method according to claim 1 wherein said secret mapping function is a binary 
function using randomized quantization steps. 

The method according to claim 1 wherein said secret mapping function is generated by 
a program. 

The method according to claim 1 wherein said secret mapping function is continuous. 

The method according to claim 1 wherein said secret mapping function is piecewise 
continuous. 

The method according to claim 1 wherein said secret mapping function is a look-up 
table. 

The method according to claim 1 wherein said secret mapping function is a pixel 
based function. 

The method according to claim 1 wherein said first predetermined order is a raster 
scan order. 

The method according to claim 2 wherein said second predetermined order is a zig-zag 
order. 

A method for extracting a watermark sequence from watermarked content comprising 
the steps of: 
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(a) receiving watermarked content comprising received coefficients; 

(b) generating an estimated watermark determined by received coefficients, and a 
mapping function; 

(c) generating a watermark sequence using a correlation function, said correlation 
function using the watermarked content, the estimated watermark, a scaling 
factor, and a weighting factor per a predetermined equation; and 

(d) outputting the watermark sequence. 

An apparatus for extracting a watermark sequence from watermarked content 
comprising: 

(a) a noise source; 

(b) a key dependent sequencer; 

(c) a mapping function having parameters, at least one of said parameters 
receiving input from said key dependent sequencer; 

(d) a watermark estimator, said watermark estimator generating a watermark 
estimate from the watermarked content, and the mapping function. 

(e) a scale factor; 

(f) a weight factor; and 

(g) a correlator, said correlator generating the watermark sequence from the 
watermarked content, the scale factor, the weight factor and the watermark 
estimate. 

An apparatus for embedding a watermark data into content including: 
(a) a content preprocessor, said content preprocessor further including: 
(i) a mean calculator; and 
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4 (ii) a variance calculator; 

5 (b) a content coefficient generator for generating content coefficients from the 

6 preprocessed content; 

7 (c) a watermark sequence generator for generating a watermark sequence from the 

8 watermark data; 

9 (d) a watermark coefficient generator for generating watermark coefficients from 

10 the watermark sequence; and 

11 (e) a watermark inserter for generating watermarked content. 

1 23. An apparatus according to claim 22, wherein said watermark inserter further includes: 

2 (a) a key dependent sequencer; 

3 (b) a secret mapping function device, said secret mapping function device 

4 receiving input from said key dependent sequencer; and 

5 (c) a coefficient modifier for generating watermarked content by adjusting the 

6 amplitude of the watermark coefficients so that the distortion between the 

7 content coefficients and the associated watermark coefficients are minimized 

8 using the secret mapping function device. 
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Abstract 

A method for embedding a watermark into content is disclosed. The content contains 
content samples. The method including the steps of: receiving the content, creating a continuous 
watermark sequence from the watermark, and for each content sample in a first predetermined 
order: calculating a sample mean, calculating a sample variance, and normalizing the content. 
Further steps include generating a set of content coefficients from the content, generating a set of 
watermark coefficients from the watermark sequence, embedding the watermark in the content 
by adjusting the amplitude of the watermark coefficients so that the distortion between the 
content coefficients and the associated watermark coefficients are minimized using a secret 
mapping function, and outputting the content. The mapping functions may be controlled by a 
key-dependent random sequence to protect the watermarks. 
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